fix: add support for preserving quoted group names in sshd_config by Gijsreyn · Pull Request #1639 · PowerShell/DSC

Gijs Reijn (Gijsreyn) · 2026-07-21T01:33:10Z

PR Summary

Fixes a bug where sshd_config list keywords with quoted, space-containing values (e.g. the Windows group "openssh users") were split into separate entries on export and get.

PR Context

Fixes #1508.

Copilot

Pull request overview

This PR fixes a Windows-specific parsing/export bug in the Microsoft.OpenSSH.SSHD/sshd_config resource where space-containing, quoted list entries (e.g. AllowGroups administrators "openssh users") were incorrectly split into separate items during get and export.

Changes:

Added a Pester test that verifies get and export preserve quoted group names containing spaces.
Updated get_sshd_settings() to prefer explicitly-parsed config-file values for space-separated multi-arg keywords (avoiding sshd -T quote-stripping/splitting behavior).
Added Rust unit tests covering the new override behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
resources/sshdconfig/tests/sshdconfig.get.tests.ps1	Adds coverage ensuring quoted group values remain a single array entry for both `get` and `export`.
resources/sshdconfig/src/get.rs	Restores correct list semantics by overriding `sshd -T`-normalized values with explicitly parsed config values for affected keywords.

Gijs Reijn (Gijsreyn) · 2026-07-21T03:07:44Z

Tess Gauthier (@tgauth) - is this something you can take a quick look at?

Tess Gauthier (tgauth) · 2026-07-21T15:42:19Z

Thanks for opening this! My initial thoughts are that this issue is applicable to other arguments that can have spaces as well (i.e. regular arguments for paths) and I wonder if we can address those here as well. I'm going to think on it a bit and see if there's a good way to do that, and if not, we can defer it to a future PR.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Tess Gauthier (tgauth) · 2026-07-29T21:27:08Z

 }
+
+fn prefer_explicit_space_sep_lists(result: &mut Map<String, Value>, explicit_settings: &Map<String, Value>) {
+    for keyword in MULTI_ARG_KEYWORDS_SPACE_SEP {


Ok to cover broader cases, I think there's two changes needed:

Expand this check to be any keyword in explicit_settings that has spaces, rather than only checking for keywords in MULTI_ARG_KEYWORDS_SPACE_SEP

When the Rust parser is parsing keywords from sshd -T, it should not error on "regular, single-value" keywords with a spaced value (i.e. Banner "C:\Program Files\ssh\sample_banner.txt" is output as Banner c:\program files\ssh\sample_banner.txt which seems like Banner has two args "c:\program" and "file\ssh\sample_banner.txt" so the parser errors currently. We should have the parser combine them into a single value)

Gijs Reijn (@Gijsreyn), if you want to leave the PR as-is and then I'll add these changes after, that's fine with me too!

Tess Gauthier (@tgauth) - thanks for the feedback! I tried to incorporate it already into this PR. Let me know what you think :)

Tess Gauthier (tgauth)

LGTM - thanks Gijs Reijn (@Gijsreyn)!

* feat: implement export filter functionality for resource exports (#1621) * feat: implement export filter functionality for resource exports * Remove comment * feat: implement export filter functionality for resource exports * Remove comment * Fix Copilot remarks * Wrong commit * Remove the wildcard support for resources * Fix Copilot remarks * Attempt to increase code coverage and fix test * Add additional test for coverage * Add test and fix dism_dsc * fix: correct code coverage calculation for uninstrumented files Files without LCOV data (e.g., platform-specific code behind #[cfg(windows)] when only Linux coverage is collected) were incorrectly counting ALL added lines as uncovered, including non-executable lines like comments and blanks. This caused coverage to drop significantly when Windows-only files were modified in a PR. Fix: skip files without LCOV data since coverage cannot be determined for uninstrumented code. Also handle the '\ No newline at end of file' diff marker which could cause off-by-one line number errors after deleted lines. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refactor work on services * Remove unused key * Revert change * Restore native resource filtering and add engine filtering fallback * Update resource definitions * Fix Copilot remark * remove directive * Change comment wording and update tests * Add crate * Revert change and fix test * Update resource manifest --------- Co-authored-by: Steve Lee <slee@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * (GH-1563) Enhance the PSScript resources (#1657) * (GH-1563) Canonicalize `_inDesiredState` for PSScript schema Prior to this change, the PSScript resource manifests embedded a schema that minimally defined the `_inDesiredState` canonical property instead of referencing the canonical schema for that property. This change updates the embedded schemas to reference the canonical schema and adds the embedded schema by ID to the `$defs` keyword. * (GH-1563) Canonicalize script properties for PSScript schemas Prior to this change, the embedded schemas in the manifests for the transitional PowerShell script resources defined the script properties with a minimal schema allowing the value to be any string or null. They didn't include any other keywords. This change: 1. Defines a shared subschema for the script properties, which they now reference instead of redefining the constraints for each property. 1. Removed `null` from the allowed types, since defining a script property as `null` isn't valid but _not_ specifying the property at all _is_ valid. 1. Added the `writeOnly` keyword to the script properties, since they're only used for input and not output. 1. Added the `contentMediaType` keyword to the script properties to clearly indicate---but not validate---that the value is expected to be a PowerShell script. 1. Added the `minLength` keyword to the script properties to ensure that an empty string isn't used as a script value. 1. Adds the `title` and `description` keywords to the script properties to provide more context for each property in the schema. * (GH-1563) Canonicalize `input` for PSScript resource schemas Prior to this change, the `input` property for the PSScript resource schemas defined the valid types with two problems: 1. It allowed `null` as a valid type, which caused failures when the resource invoked the scripts. 1. It didn't allow non-integer numbers, erroneously preventing users from defining input values like `3.14`, even though `[3.14]` was accepted. This change: 1. Removes `null` from the valid types for `input`. 1. Adds `number` to the valid types for `input`, allowing non-integer numbers to be used as input values. 1. Adds the `title` and `description` keywords to the `input` property, providing better documentation for users. * (GH-1563) Add constraints to PSScript resource schema Prior to this change, the embedded schemas for the PSScript resources didn't require any properties to be defined. For input, a user should always define at least one script property. For output, the resource should always return one of three value shapes: 1. For `test` operations, the resource should always define the `inDesiredState` property. 1. For implemented `get` and `set` operations, the resource should define the `output` property when the script emits any output to the success stream. 1. When `get` and `set` operations aren't implemented or don't emit any output, the resource should return an empty object. This change adds constraints to the embedded schemas with the `oneOf` keyword and nested `oneOf`/`anyOf` keywords to enforce these rules. * (GH-1563) Add docs keywords for PSScript resources Prior to this change, the embedded schema for the PSScript resources didn't define the `title` or `description` keywords. This change: 1. Adds `title` and `description` keywords to the embedded schema for the PSScript resources to provide some documentation for them. 1. Defines the `$schema` keyword explicitly. * (GH-1563) Canonicalize output for PSScript resources Prior to this change, the PSScript resources: 1. Always returned an array of output objects, even if there was only one object. 1. Didn't ensure that enums in script output were serialized as strings, causing enums to emit as integers, which is likely not what the user intended and makes review more difficult. This change: 1. Ensures that if a script returns a single object, it's serialized as that object instead of nested in an array. 1. Adds the `-EnumAsString` parameter to the `ConvertTo-Json` call for emitting script output when invoked through PowerShell to ensure that enums are serialized as strings. This enhancement doesn't affect Windows PowerShell, which doesn't support the `-EnumAsString` parameter. 1. Updates the tests to reflect the new behavior of returning a single object instead of an array. 1. Fixes the tests to use correct casing for the script properties, now that the schema validation checks for those properties. * (GH-1563) Fix tests using invalid casing for PSScript resource Prior to this change, some tests were using invalid casing for the PSScript resource type, which didn't previously cause errors during the JSON Schema validation because the schema didn't forbid additional properties. The tests passed because PowerShell isn't case-sensitive, so was able to retrieve the properties even with incorrect casing. With the changes to the JSON schema _requiring_ one or more script properties, these tests began to fail because the invalidly-cased property names didn't satisfy the JSON Schema. This change corrects the casing in the test definitions to ensure both that the tests are correct and pass the schema validation. * Apply suggestions from review Co-authored-by: Steve Lee <slee@microsoft.com> --------- Co-authored-by: Steve Lee <slee@microsoft.com> * Add JSON schema caching (#1637) * Add JSON schema caching * address copilot feedback * fix copilot feedback to not deserializing the json * rename function to be singular * make helpers scoped to crate * make cache crate only * fix: add support for preserving quoted group names in sshd_config (#1639) * fix: add support for preserving quoted group names in sshd_config * Update with remarks Tess --------- Co-authored-by: Gijs Reijn <26114636+Gijsreyn@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com>

Copilot AI review requested due to automatic review settings July 21, 2026 01:33

Copilot started reviewing on behalf of Gijs Reijn (Gijsreyn) July 21, 2026 01:34 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Gijs Reijn (Gijsreyn) force-pushed the gh-1508/main/fix-space-sshd branch from 0faeeaf to 9b7da04 Compare July 21, 2026 03:06

Gijs Reijn (Gijsreyn) force-pushed the gh-1508/main/fix-space-sshd branch from 9b7da04 to b991333 Compare July 22, 2026 04:19

Copilot AI review requested due to automatic review settings July 22, 2026 04:19

Copilot started reviewing on behalf of Gijs Reijn (Gijsreyn) July 22, 2026 04:20 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread resources/sshdconfig/src/get.rs Outdated

Steve Lee (SteveL-MSFT) added this to the 3.3-Approved milestone Jul 24, 2026

Mikey Lombardi (He/Him) (michaeltlombardi) requested a review from Tess Gauthier (tgauth) July 29, 2026 20:29

Tess Gauthier (tgauth) reviewed Jul 29, 2026

View reviewed changes

Gijs Reijn (Gijsreyn) added 2 commits July 30, 2026 07:11

fix: add support for preserving quoted group names in sshd_config

2e1651b

Update with remarks Tess

4f80db6

Gijs Reijn (Gijsreyn) force-pushed the gh-1508/main/fix-space-sshd branch from 0161afd to 4f80db6 Compare July 30, 2026 07:11

Tess Gauthier (tgauth) approved these changes Jul 31, 2026

View reviewed changes

Tess Gauthier (tgauth) added this pull request to the merge queue Jul 31, 2026

Merged via the queue into PowerShell:main with commit 430bc56 Jul 31, 2026
20 checks passed

Steve Lee (SteveL-MSFT) added Backport-Needed Backport-Done and removed Backport-Needed labels Aug 10, 2026

Steve Lee (SteveL-MSFT) mentioned this pull request Aug 10, 2026

3.3 rc.1 backport fixes #1662

Merged

Navigation Menu

Uh oh!

fix: add support for preserving quoted group names in sshd_config - #1639

fix: add support for preserving quoted group names in sshd_config#1639
Tess Gauthier (tgauth) merged 2 commits into
PowerShell:mainfrom
Gijsreyn:gh-1508/main/fix-space-sshd

Gijs Reijn (Gijsreyn) commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Gijs Reijn (Gijsreyn) commented Jul 21, 2026

Uh oh!

Tess Gauthier (tgauth) commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Tess Gauthier (tgauth) Jul 29, 2026

Uh oh!

Gijs Reijn (Gijsreyn) Jul 30, 2026

Uh oh!

Tess Gauthier (tgauth) left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Gijs Reijn (Gijsreyn) commented Jul 21, 2026

PR Summary

PR Context

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Gijs Reijn (Gijsreyn) commented Jul 21, 2026

Uh oh!

Tess Gauthier (tgauth) commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Tess Gauthier (tgauth) Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Gijs Reijn (Gijsreyn) Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Tess Gauthier (tgauth) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants